Red Hat Bugzilla – Bug 1304504
CVE-2016-2533 python-pillow: Buffer overflow in PCD decoding
Last modified: 2016-11-08 10:49:09 EST
A heap-based buffer overflow flaw was reported in Pillow's PCD decoding. By tricking an unsuspecting user or automated script into processing a specially crafted PCD image file, an attacker could cause the Python process to crash, or, potentially, execute arbitrary code with the privileges of the Python script processing the image.
The problem is that the "ImagingPcdDecode()" function in PcdDecode.c increases a the unpack buffer pointer by 4 bytes (=32bit color), although the buffer is only supposed to hold 24bits of color (=3 bytes). This ultimately leads to an array indexing error resulting in an out-of-bounds write.
Upstream bug report:
*** Bug 1305004 has been marked as a duplicate of this bug. ***
This still needs a CVE. A request has been sent to oss-sec before, but I don't think one was ever assigned. I've asked for an update: